Cobub Razor 0.7.2 – Cross-Site Request Forgery - 体验盒子

作者： ppb

日期： 2018-04-06

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/44416/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

# Exploit Title: Cobub Razor 0.7.2 Cross Site Request Forgery

# Date: 2018-03-07

# Exploit Author: ppb

# Vendor Homepage: https://github.com/cobub/razor/

# Software Link: https://github.com/cobub/razor/

# Version: 0.72

# CVE : CVE-2018-7746

There is a vulnerability. Authentication is not required for /index.php?/manage/channel/modifychannel. For example, with a crafted channel name, stored XSS is triggered during a later /index.php?/manage/channel request by an admin.

<html>

<body>

</form>

</body>

</html>